# GaaS — Governance as a Service for AI Agents

> GaaS is a governance pipeline that sits between an AI agent's intent and its execution. It enriches context, evaluates policy, deliberates risk via multi-agent panels, and produces a tamper-evident audit trail. Sub-100ms for routine actions. Full multi-agent deliberation for high-stakes decisions. Built by H2Om. See [concise summary](https://gaas.is/llms.txt) for a shorter overview.

## What GaaS Is

GaaS solves a critical problem: autonomous AI agents are acting in the world — sending emails, executing transactions, accessing records, posting content, and controlling physical systems — and the governance model for most of them is "hope the prompt was good enough."

GaaS provides the institutional checks that every hospital, bank, and trading floor requires of human employees, but for AI agents. Structured, fast, transparent, and auditable.

The core architectural principle: **the agent is not the governor.** The agent proposing an action and the system evaluating it are architecturally separate. An agent cannot govern itself.

## Five-Stage Governance Pipeline

### Stage 1: Intent Declaration
The agent declares what it intends to do. If it can't declare it, it can't do it. This is the entry point — a structured schema parse that captures the action, target, risk level, and context.

### Stage 2: Context Enrichment
GaaS discovers what the agent doesn't know. Missing context is itself a finding. Parallel fetches gather the facts from the organization's own systems (through its context endpoint) and GaaS's own records.

### Stage 3: Policy Evaluation
Four-tier policy hierarchy: Universal → Regulatory → Organizational → Agent-specific. Deterministic rule matching against the enriched context.

### Stage 4: Deliberation Engine (about 40–60 s end to end)
Only triggered for high-risk, novel or conflicting actions. A multi-agent panel debates the action:
- Round 1 (parallel): up to 5 reviewer assessments run concurrently
- Round 2 (cross-examination): Dissenters respond to each other
- Round 3 (final vote): Revised positions and final votes

A completed deliberation bills as one deliberation-class decision ($0.05) beyond your plan's included actions; a failed deliberation bills as routine.

### Stage 5: Decision + Audit (routine decisions: median 24 ms, p95 36 ms end to end for stages 1–3 and 5)
A tamper-evident, hash-chained (SHA-256) audit record for every decision, exportable, with policy epoch versioning; the chain can be checked through the API. Records are signed (ECDSA P-256), and every live decision carries a proof token anyone can check without an API key. Once a day, each organization's audit records are combined into one digest and stamped into Bitcoin through the free, public OpenTimestamps service; the customer downloads the proof and checks it with the standard `ots` tool, without trusting GaaS (https://gaas.to/audit-timestamps). Live since 2026-09-29: the first run stamped the previous seven days, confirmed in Bitcoin from block 969093. When a regulator asks "show me your governance program," this is the answer.

## Core Principles

1. **The agent is not the governor** — The agent proposing an action and the system evaluating it are architecturally separate. An agent cannot govern itself.
2. **Fail-safe, not fail-open** — If governance fails, the action is blocked. Not approved. Not silently passed through. Blocked.
3. **Speed scales with risk** — Sub-100ms for routine actions (median 24 ms in production). About 40–60 seconds of full multi-agent deliberation for high-stakes decisions. The governance tax is proportional to the governance need.
4. **Every decision is auditable** — Tamper-evident, hash-chained audit records with policy epoch versioning and complete reasoning chains. Records are signed and timestamped daily in Bitcoin, and every live decision carries a proof token anyone can check.

## Integration

One governance call before each agent action:

```python
# pip install gaas-sdk
from gaas_sdk import GaaSClient, build_intent, ActionType, TargetType

async with GaaSClient(
    "https://api.gaas.is",
    headers={"X-API-Key": "gsk_..."},
) as client:
    intent = build_intent(
        agent_id="my-agent",
        action_type=ActionType.COMMUNICATE,
        verb="send",
        target_type=TargetType.ENDPOINT,
        target_identifier="email-service",
        summary="Send welcome email to new user",
        content={"template": "welcome_series"},
    )
    response = await client.submit_intent(intent)
    print(response.data.verdict)  # approve | approve_modified | escalate | block
```

**SDKs:** Python, TypeScript, Java (`is.gaas:gaas-sdk`, from https://maven.gaas.is, Java 17+)
**Framework Plugins:** LangChain, OpenAI Agents, CrewAI, Pydantic AI, Vercel AI, Microsoft Agent Framework, and MCP
**Microsoft Agent Framework plugin** (Python 3.11+, agent-framework-core 1.15+): `pip install "gaas-agent-framework[agent-framework]"`, then `from gaas_agent_framework import GaaSGovernanceMiddleware, GaaSGovernanceConfig`. Guide: https://gaas.to/sdks.html#agent-framework
**Java SDK** (Java 17+): `is.gaas:gaas-sdk:0.3.1` from GaaS's own repository https://maven.gaas.is (not Maven Central); add the repository and the dependency (Maven, Gradle or Gradle Kotlin). Guide: https://gaas.to/sdks.html#java
**Protocol:** REST/HTTPS, JSON payloads

## Context Connectors (29 built, 27 listed; none switched on in the hosted service yet)

When a connector is switched on, Stage 2 of the governance pipeline queries it in parallel during context enrichment. Today none is. Since 2026-09-29 each organization instead connects its own systems through one HTTPS context endpoint (dashboard Settings → Connected systems, or the API at /v1/context-endpoint). During every decision GaaS sends it a signed request describing the action (never its free-text content) and reads back the facts the policies check, in six categories: environment, account state, regulatory, organizational, identity and security. Its secrets are encrypted with AWS KMS; if it fails or is slow, the decision still happens and the missing facts count as risk. Guide: https://gaas.to/context-endpoint.html

Full catalogue, with the data each connector enriches, the API it reads, and a governance use case: https://gaas.is/connectors

Enterprise: Twilio, Salesforce, Stripe, GitHub, Okta, Datadog, Slack, Workday, Zendesk, Microsoft Teams, Google Workspace, Jira, Asana, Vanta, PagerDuty
Education: Canvas LMS, Clever
IoT & Smart Home: Alexa Smart Home, Samsung SmartThings, Google Nest, Honeywell Home, Philips Hue
Energy & Fleet: Tesla Fleet, SolarEdge Monitoring
Agriculture & Equipment: AEMP 2.0 (ISO 15143-3), Leaf Agriculture
Logistics: ShipStation

## Bidirectional Governance

### Outbound Governance
Control what your AI agents do in the world. Every action evaluated before execution. Your agents, governed.

### Inbound Governance
Control what visiting AI agents do on your digital property. Identify, gate, monitor, and audit. Your property, protected.

Organizations that govern their outbound agents earn trust tokens recognized across the GaaS network.

## Trust Tiers

1. **Registered** — SDK integrated, basic policies configured → GaaS token issued
2. **Verified** — 30-day compliant operation demonstrated → Elevated trust tokens
3. **Certified** — Independent audit, full deliberation enabled → H2Om GaaS Certified

## Architecture: Two Planes

### Control Plane (Runs on GaaS.is)
Governance logic, regulatory intelligence, policy evaluation, audit infrastructure, and learning systems. Deterministic compute. This is what your plan pays for.

### Inference Plane
LLM compute that powers deliberation agents. GaaS sends structured prompts; the deliberation panel produces assessments. Only triggered for high-risk actions. On GaaS Complete, deliberation inference is included in every plan. On GaaS Core (BYOM), the Inference Plane points at your own model endpoint instead.

## Pricing

### Plans
| Plan | Price | Actions/mo | Agents | Billing |
|------|-------|-----------|--------|---------|
| Free | $0 | 1K | 1 | — |
| Developer | $99/mo | 10K | 3 | Monthly |
| Starter | $500/mo | 50K | 3 | Monthly |
| Growth | $2,500/mo | 500K | 15 | Monthly |
| Enterprise | $10,000+/mo | 5M+ | Unlimited | Annual |

The table above is **GaaS Complete** — deliberation inference included, run by H2Om.

### GaaS Core — Bring Your Own Model (BYOM)
Core runs the identical governance pipeline (control plane, CKB, audit trail, learning engine, dashboard) but points the deliberation stage at your own model endpoint. You keep your provider, your negotiated rates, and your data residency; H2Om bills orchestration only, so the platform fee drops 30%.

| Plan | Price | Actions/mo | Agents | Complete equivalent |
|------|-------|-----------|--------|---------------------|
| Starter | $350/mo | 50K | 3 | $500/mo |
| Growth | $1,750/mo | 500K | 15 | $2,500/mo |
| Enterprise | Custom | 5M+ | Unlimited | Custom |

Core starts at Starter — the Free and Developer plans are managed-inference only. On Core, deliberation inference tokens are billed by your own provider, not by H2Om.

### Priced on Decisions — Overage
Beyond your plan's included monthly actions, each additional decision bills once, in its highest applicable class:

| Class | Complete | Core (BYOM) | When it applies | Which actions |
|-------|----------|-------------|-----------------|--------------|
| Routine (approve/block/modify) | $0.002 | $0.0015 | Fast policy-evaluation path | Most actions |
| Deliberation (multi-agent panel) | $0.05 | $0.01 + your tokens | Deliberation ran to completion | High-risk, novel or conflicting actions |
| Escalation (human review routing) | $0.25 | $0.25 | Escalated to a human reviewer | Actions a human must decide |

Escalation is priced identically on both plans because human review involves no model compute.

### Fairness Rules
- Shadow and test decisions are never metered.
- A failed deliberation bills as routine — you don't pay for GaaS failures.
- Each decision counts exactly once, in its highest applicable class.
- The audit record is not metered and never will be (record-free-forever pledge).

Overage billing is active as of 1 August 2026, following a full report-only cycle. Decisions beyond a plan's included monthly actions bill at the per-decision prices above.

## Shadow Mode (Free Trial)

Start a free shadow deployment: real actions, real verdicts, zero enforcement. See what GaaS governance reveals about your agents — then decide when to go live.

- **Duration:** 14 days free
- **Credit card:** Not required
- **Commitment:** None
- **How:** Submit intents with `?mode=shadow` (deliberation is skipped in shadow mode), review shadow stats in dashboard, activate enforcement when ready (`POST /v1/membranes/{membrane_id}/activate`)
- **Optional:** connect your own systems with `PUT /v1/context-endpoint` (the quickstart key is an admin key), and try it in shadow mode first

### Onboarding API
- **Endpoint:** POST https://api.gaas.is/v1/onboarding/quickstart
- **Content-Type:** application/json
- **Request body:** `{ "email": "...", "org_name": "...", "description": "..." }`
- **Response (201):** `{ "membrane_id": "...", "membrane_status": "shadow", "org_id": "...", "api_key": "...", "key_id": "...", "quickstart_snippet": "...", "next_steps": [...] }` (the key is an admin key for the new organization)
- **Errors:** 413 (body over 1 MB), 422 (missing or invalid fields), 429 (10 a minute)

## A2A Protocol Governance

The A2A (Agent-to-Agent) protocol — created by Google, now hosted by the Linux Foundation and backed by 150+ organizations — defines how agents communicate. GaaS is the governance layer that lets operators say "yes" to workflows they'd otherwise handle manually.

**MCP** gives agents tools. **A2A** gives agents colleagues. **GaaS** lets them do more.

### The Governance Gap

A2A defines communication but not trust. What A2A provides: Agent Cards for capability discovery, structured task lifecycle management, JSON-RPC 2.0 transport, push notifications and streaming (GaaS's endpoint streams; push notifications are not available yet), skill-based agent discovery. What GaaS adds: policy evaluation on every interaction, real-time risk scoring, tamper-evident audit trails, human-in-the-loop escalation, regulatory compliance (EU AI Act, PCI DSS, PSD2).

### Connect over A2A v1.0

GaaS is an A2A v1.0 agent, built on the official A2A SDK and tested on every change with the official A2A conformance suite (TCK): every MUST-level requirement it can test passes. Guide: https://gaas.to/a2a.html

- Endpoint: JSON-RPC at POST https://api.gaas.is/a2a/v1. Every call needs the A2A-Version: 1.0 header; without it the reply is error -32009, as the spec requires.
- Agent Card: https://api.gaas.is/.well-known/agent-card.json (the old /.well-known/agent.json redirects there).
- Methods: SendMessage, SendStreamingMessage, GetTask, ListTasks, CancelTask, SubscribeToTask. Push notifications are not available yet (error -32003).
- Sign-in: an API key in the X-API-Key header is the only sign-in.
- Isolation: a task belongs to the organization whose key created it; any other organization gets "task not found".
- Verdicts as task states: approve → completed, block → rejected, escalate → input-required (a person decides; a follow-up message on the task reports the decision).
- Proxy: /a2a/proxy/* is a GaaS extension; it governs messages but does not forward them yet.

### Six Capabilities

1. **Governance Proxy** — A2A messages sent to GaaS's A2A v1.0 endpoint go through the five-stage governance pipeline, and the verdict becomes the task's state (approve → completed, block → rejected, escalate → input-required, where a person decides); forwarding messages on to the target agent (the `/a2a/proxy/*` extension) is built, not yet switched on.
2. **Agent Trust Registry** — A2A's Agent Cards describe capabilities. GaaS adds dynamic trust scores based on interaction history, compliance posture, and governance track record.
3. **Payment Governance** — Agents executing financial transactions via A2A get spend-limit enforcement, PCI DSS and PSD2 compliance, and mandate validation before funds move.
4. **Delegation Chains** — When Agent A delegates to B who delegates to C, each governed hop is recorded with its parent, and every record in the chain is hash-verified (SHA-256).
5. **Cross-Org Federation** — Built, not yet enabled: when A2A connects agents across organizations, GaaS negotiates governance requirements and verifies mutual compliance before the first message.
6. **Shadow Mode** — Deploy governance on A2A interactions without enforcement. See what would have been blocked, modified, or escalated — zero risk, full visibility.

### Architecture Stack

Enterprise (Compliance, Audit Trails, Trust Tiers, HITL Escalation) → GaaS (Policy, Risk Scoring, Verdicts, Delegation Chains) → A2A Protocol (Agent Cards, Tasks, JSON-RPC, SSE) → Agent Runtime (LLMs, Tools, Memory, State).

### Regulatory Context

The EU AI Act (Article 14) mandates human oversight for high-risk AI systems. As A2A adoption accelerates multi-agent deployments, enterprises need a governance layer between protocol and production. GaaS provides the policy evaluation, audit trails, and human-in-the-loop escalation that regulators require.

## Compliance Frameworks

GaaS evaluates every governance decision against 12 regulatory frameworks with 59 built-in policies. Coverage is automatic — activated based on action type, jurisdiction, and industry classification.

**Enforced (active blocking/modification):**
- HIPAA — PHI detection and blocking, minimum necessary standard, BAA-ready audit trail
- PCI DSS — Cardholder data detection and blocking, agent payment compliance
- PSD2 SCA — Strong Customer Authentication for agent-initiated payments
- FERPA — Education record protection, student PII role-based access
- CCPA — California consumer privacy rules on actions that touch personal information
- SOX — Sarbanes-Oxley controls on actions that touch financial records and reporting
- TCPA + Florida FTSA — consent and contact rules for agent-initiated calls and texts

**Policy-driven (evaluation + reporting):**
- EU AI Act — Articles 9, 10, 13, 14 and 15, risk classification, transparency, human oversight (transparency obligations since 2 Aug 2026; high-risk obligations from 2 Dec 2027 for Annex III and 2 Aug 2028 for Annex I)
- GDPR — Erasure, portability, automated decision explanation, sub-processor management

**Mapped (alignment documentation):**
- NIST 800-53 — AC, AU, IA, SC control families for AI agent governance
- FedRAMP — Moderate baseline alignment, control inheritance documentation
- CMMC — Level 2 practices for defense contractor agent governance
- NIST CSF — Identify/Protect/Detect/Respond/Recover mapped to pipeline stages
- SR 11-7 — Model inventory, validation status, decision statistics (Federal Reserve); a record of every agent for your own model risk management (CSV/HTML export). Built for SR 11-7, which SR 26-2 (Federal Reserve, OCC, FDIC) replaced on 17 April 2026; SR 26-2 places generative and agentic AI models outside its scope. Not an enforced framework

## External Validation

arXiv:2508.18765 (Gaurav, Heikkonen, and Chaudhary, August 2025), "Governance-as-a-Service: A Multi-Agent Framework for AI System Compliance and Policy Enforcement," independently defines GaaS as a modular, policy-driven enforcement layer that regulates agent outputs at runtime — the same runtime-enforcement definition used across this site. GaaS (the product) is a production implementation of that pattern.

## Security

Defense-in-depth from the API boundary to the audit record. All security controls are Tier 1 (non-disableable).

- Prompt Injection Detection: 17 regex pattern signatures + imperative heuristic. Scanned at Stage 1 (before enrichment) and re-scanned at Stage 3 (after enrichment). Flagged payloads rejected immediately.
- Behavioral Anomaly Governance (live and enforcing since 2026-09-28): an action type or sensitivity counts as unusual only if it is new, or under 2% of the agent's last 200 live decisions (with at least 15 on record); blocked attempts are never learnt.
- Session Trust Decay (live and enforcing since 2026-09-28): Trust scores degrade over session lifetime. Longer sessions require re-validation. A person's approval restores an agent's trust.
- SIEM Integration: through signed per-organization webhooks and a published guide (Splunk, Sentinel, QRadar); the old global push was retired. Three Sigma detection rules ship as documentation.
- Rate Anomaly Detection: Identifies unusual request velocity patterns per agent.
- Self-Governance Prevention: Agents cannot modify their own governance policies or trust tier.

## Patent

Provisional patent filed March 11, 2026, covering the GaaS multi-stage governance pipeline architecture for autonomous AI agents — including external intent declaration, context enrichment, policy evaluation, multi-agent deliberation, and tamper-evident audit trail generation.

## Blog

### Agentic AI Governance: The Infrastructure Gap Nobody's Filling
*H2Om Technologies — 15 February 2026 — 14 min read*

Every hospital, bank, and trading floor requires institutional oversight of its human employees. AI agents are now doing the same work with none of the same checks. This article covers: the governance problem with agentic AI, why agents aren't chatbots and why that breaks existing approaches, the self-governance fallacy (conflict of interest, computational cost, quality problems), regulatory walls closing in (EU AI Act, NIST AI RMF, FDA, SEC/FINRA), what agentic AI governance actually looks like (five-stage pipeline), and governance as infrastructure rather than a feature.

URL: https://gaas.is/blog/agentic-ai-governance/

### AI Governance Pipeline: The Selective Membrane for Autonomous Agents
*H2Om Technologies — 16 February 2026 — 13 min read*

Just as cell membranes control what enters and exits a living system, AI governance pipelines act as selective membranes between agent intent and execution. This article covers: what an AI governance pipeline is, the governance membrane metaphor (selective permeability), the five stages of a governance pipeline, pipeline architecture (speed, scale, separation of concerns), building vs. buying the pipeline, and the future of governance credentials and agent trust networks.

URL: https://gaas.is/blog/gaas-pipeline/

### Who Holds the Evidence? Governing AI Agents You Didn't Build
*H2Om Technologies — 1 September 2026 — 14 min read*

Every serious agent platform now checks actions before they run and keeps its own record of having done so — but a record kept by the system it describes is an assertion, not evidence. This article covers: why agents span platforms that each govern only their own slice, what is already settled (an agent cannot govern itself) and where this picks up, custody versus capability, why integrity and faithful capture are orthogonal axes (a chain proves nothing was altered after capture; it cannot prove capture was faithful), the structural ceiling on platform-native governance, what auditors actually ask (which party captured the record, and which control version evaluated it), the typed basis of a fact (self_reported, observed, attested), and four properties of evidence you can hand to a stranger. Sources include the public Microsoft Agent Governance Toolkit discussion on policy enforcement versus decision evidence.

URL: https://gaas.is/blog/who-holds-the-evidence/
### Control Your AI: Trust It When You Are Not Looking
*H2Om Technologies — 1 July 2026 (updated 3 July 2026) — 6 min read*

You put an agent to work. Control is the difference between hoping it behaves and knowing it will — a line you draw once that the agent cannot cross. This article covers: who is holding the wheel once you give an AI the keys, why control is knowing rather than hoping, trusting an agent when you are not looking, the four verdicts that make behaviour repeatable the same way every time (approve, modify, escalate, block), and why holding the rules outside the agent pays you back in reclaimed context.

URL: https://gaas.is/blog/control-your-ai/
### The EU AI Act and Your AI Agents: What Actually Applies Right Now
*H2Om Technologies — 1 September 2026 — 15 min read*

A dated, source-stamped map of which EU AI Act obligations bind AI agents as of 1 September 2026, written because most guidance still online predates the July 2026 amendment and states a high-risk date that is now wrong. This article covers: what applies today (Article 5 prohibitions and AI literacy since 2 February 2025, GPAI since 2 August 2025, Article 50 transparency since 2 August 2026, Annex III high-risk deferred to 2 December 2027 and Annex I to 2 August 2028); what Regulation (EU) 2026/1744 — the Digital Omnibus on AI, adopted 8 July 2026, in force 27 July 2026 — actually changed; Article 50(1) and why agents interacting with people must disclose they are AI; the logging duties split across Article 12, Article 19 and Article 26(6) with its six-month deployer retention floor; why a log is not the same as evidence; Article 14(4)(b), automation bias and how approval fatigue destroys human oversight; and the revised Product Liability Directive (EU) 2024/2853, which treats software and AI systems as products from 9 December 2026. Every date carries a visible verification stamp recording when it was last checked against the primary source.

URL: https://gaas.is/blog/eu-ai-act-ai-agent-logging/

## White Paper: The Context Dividend

Edition 5 (updated 2026-09-29, including the confirmation that daily public timestamps are in Bitcoin), measured against the live system. A self-governing agent on Claude Opus 5.5 spends about 14,700 tokens of context per routine governed action, and 23,400–40,600 when the action needs deliberation. With GaaS it spends 0 tokens on an approved action and 74 on a blocked one through a framework plugin, or about 2,470 through the MCP server: an 83–100% reduction. At 500,000 governed actions a month that returns about 7.4 billion tokens (plugin) or 6.1 billion (MCP), worth about $73,000 a month at Opus 5.5 list prices (about $56,000 with prompt caching). The share of the context window reclaimed depends on the session: self-governance fills 30% of a 200K window after about 14 routine governed actions and 60% after about 28 (about 50 and 102 on a 1M window). PDF: https://gaas.is/the-context-dividend.pdf

Read it on the web (one permanent page, updated in place with each edition): https://gaas.is/the-context-dividend · markdown: https://gaas.is/the-context-dividend.md

Summary page with the published figures: https://gaas.is/context-dividend — a self-governing agent on Claude Opus 5.5 spends about 14,700 tokens of context per routine governed action; GaaS costs it 0 through a framework plugin (74 on a block) or about 2,470 through MCP, 83–100% less. At 500,000 governed actions a month, self-governance costs about $73,000 in tokens at Opus 5.5 list prices (about $56,000 with prompt caching), and GaaS returns about 7.4 billion tokens (plugin) or 6.1 billion (MCP) to the work.

## Links

- Website: https://gaas.is
- Control What Your AI Agents Do: https://gaas.is/control-your-agents
- For Agents: https://gaas.is/for-agents
- Pricing: https://gaas.is/pricing
- For AI Operators: https://gaas.is/for-operators
- For Content & Social Agencies: https://gaas.is/for-agencies
- Start Shadow Mode: https://gaas.is/start
- For Parts & Purchasing: https://gaas.is/for-purchasing
- For Healthcare & HIPAA: https://gaas.is/for-healthcare
- For Retail & Customer Service: https://gaas.is/for-retail
- API Documentation: https://gaas.is/api-docs
- What Is GaaS: https://gaas.is/what-is-gaas
- Governance as a Service (the term, defined; cites arXiv:2508.18765; 12 named frameworks; first-week rollout; plan ladder): https://gaas.is/governance-as-a-service
- What Is AI Agent Governance: https://gaas.is/what-is-ai-agent-governance
- How It Works: https://gaas.is/how-it-works
- A2A Protocol Governance: https://gaas.is/a2a-protocol/
- Technical Specifications: https://gaas.is/tech-specs
- Trust, Audit & the Spec: https://gaas.is/trust
- Careers (hiring via LinkedIn only): https://gaas.is/careers
- About GaaS: https://gaas.is/about-gaas-and-how-GaaS-governs-agentic-AI
- OpenAPI Spec: https://gaas.is/openapi.yaml (core, trust and context-endpoint routes; complete spec: https://api.gaas.is/openapi.json)
- GitHub: https://github.com/H2OmAI
- White Paper (PDF): https://gaas.is/the-context-dividend.pdf
- White Paper (web edition): https://gaas.is/the-context-dividend
- The Context Dividend (summary page): https://gaas.is/context-dividend
- Blog: https://gaas.is/blog/
- Control Your AI (page): https://gaas.is/control-your-ai
- Control Your AI (article): https://gaas.is/blog/control-your-ai/
- Who Holds the Evidence? (article): https://gaas.is/blog/who-holds-the-evidence/
- The EU AI Act and Your AI Agents (article): https://gaas.is/blog/eu-ai-act-ai-agent-logging/
- Sign Up: https://the.gaas.is/signup
- API Base URL: https://api.gaas.is/v1

## Markdown Versions (for LLM consumption)

- https://gaas.is/index.md
- https://gaas.is/pricing.md
- https://gaas.is/start.md
- https://gaas.is/api-docs.md
- https://gaas.is/for-agents.md
- https://gaas.is/a2a-protocol/index.md
- https://gaas.is/governance-as-a-service.md